Atty. Ref.: P5599 

Claims 

is claimed is: 

A method of operating a storage system comprising: 

storing a plurality of data blocks having a horizontal redundant relationship; 

storing a plurality of checksums, each/checksum having a vertical redundant relationship 
with a corresponding one of tfte plurality of data blocks; and 

in response to detection of a data integrity error in at least one of the plurality of data 
blocks, reviewing the vertical redundant relationships between each of the 
checksums in the plurality of checksums and the corresponding data blocks. 

The method of Claim 1, wherein/ 

said reviewing the vertical redundant relationships comprises calculating a new checksum 
for each of the data blodks in the plurality of data blocks and comparing the 
calculated new checksum to the checksum from the plurality of checksums 
corresponding to that data block. 

The method of Claim 1 , wherein: 

said storing the plurality of checksums comprises storing the plurality of checksums such 
that each data block/in the plurality of data blocks has a vertical redundant 
relationship with a set of corresponding checksums, and each of the checksums in 
the set of corresponding checksums has a horizontal checksum redundant 
relationship with the other checksums in the set of corresponding checksums. 

The method of Claim 3, iurther comprising: 
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in response to detecting a first data integrity error between a first data block and a first 
checksum from a first set of checksjnfis corresponding to the first data block, 
reviewing the vertical reduncjafit relationship between the first data block and the 
remaining checksums ifrlhe first set of checksums; and 

in response to detecting^) data integrity errors between the first data block and the 
remaining checksums in the first set of checksums, creating a restored first 
checksum to replace the first checksum corresponding to the first data integrity 



The method of Claim 1, 

in response to detection o 
blocks, reviewing 
having the data ip* 1 
data block^^ 




comprising: 

ity error in at least one of the plurality of data 
f izontal redundant relationship between the data block 
egrity error and the remaining data blocks in the plurality of 



The method of Claim 5, wherein/ 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and / 

said reviewing the horizontal redundant relationship comprises calculating a new parity 
stripe unit based an the plurality of data stripe units and comparing the calculated 
new parity striper unit to the parity stripe unit from the plurality of data blocks. 

The method of Claim/5, wherein: 

said plurality of data/blocks comprises a first mirrored data block and a corresponding 
second mirrored data block; and 
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said reviewing the horizontal redundant relationship] comprises comparing the first 
mirrored data block and the second mirrorep data block. 

The method of Claim 5, further comprising: / 

in response to detecting a first data integrity jerror in exactly one of the vertical redundant 
relationships and detecting no data integrity errors in the horizontal redundant 
relationship, creating a restored checksum using the data block corresponding to 
the first data integrity error to replace the existing checksum corresponding to the 
first data integrity error. / 

The method of Claim 5, further comprising: 

in response to detecting a first dap integrity error in exactly one of the vertical redundant 
relationships and detecting a second data integrity error in the horizontal 
redundant relationship, creating a restored data block using the horizontal . 
redundant relationship/to replace the data block corresponding to the first data 
integrity error and comparing the restored data block to the checksum 
corresponding to the first data integrity error. 

The method of Claim 9, mrther comprising: 

in response to a mismatch between the restored data block and the checksum 

corresponding ko the first data integrity error, creating a restored checksum using ... 
the restored data block to replace the checksum corresponding to the first data 
integrity error. 

The method of Claim 5, further comprising: 



Page 21 




Atty. Ref.: P5599 



in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting no data integrity errors in the horizontal redundant 
relationship, reporting a data loss condition.^ 

The method of Claim 5, further comprising: 

in response to detecting a first data integrity erfcr in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and detecting a third da/a integrity error in the horizontal redundant 
relationship: 

creating a first restored data block/using the horizontal redundant relationship to 
replace the data block corresponding to the first vertical redundant 
relationship; 

comparing the first restored data block to the checksum corresponding to the first 
vertical redundant relationship; 

creating a second restored data block using the horizontal redundant relationship 
to replace the data tylock corresponding to the second vertical redundant 
relationship; and 

comparing the second restored data block to the checksum corresponding to the 
second vertical redundant relationship. 



The method of Claim 12, further comprising: 

reporting a data loss condition in response to either: 

(a) a mismatch baween the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch 
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between the second restored data block And the checksum corresponding 
to the second vertical redundant relationship; or 

(b) a match between the first restored data block and the checksum corresponding 
to the first vertical redundant relationship and a match between the second 
restored data block and the checksum corresponding to the second vertical 
redundant relationship. / 

The method of Claim 12, further comprising: / 

in response to a match between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch between 
the second restored data block and ihe checksum corresponding to the second 
vertical redundant relationship, creating a restored checksum using the second 
restored data block to replace th^f checksum corresponding to the second vertical 
redundant relationship. 

The method of Claim 1 , further co: 

in response to detecting data integi 
relationships, reporting a di 

A storage system, comprising: / 
a storage array comprising a plurality of storage devices; 

a plurality of data blocks having a horizontal redundant relationship, each data block 
stored on one of the plurality of storage devices; 

a plurality of checksums, each checksum having a vertical redundant relationship with a 
corresponding one of the plurality of data blocks; and 



arising: 



lty errors in at least three of the vertical redundant 
ita loss. 
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an array manager coupled to the storage array, wherein said array manager is configured 
such that in response to detection of a data integrity error in at least one of the 
plurality of data blocks, said array manager reviews the vertical redundant 
relationships between each of the checksums inihe plurality of checksums and the 
corresponding data blocks. / 

The storage system of Claim 16, wherein: / 

said array manager is configured to review the vertical redundant relationships by 

calculating a new checksum for each oythe data blocks in the plurality of data 
blocks and comparing the calculated new checksum to the checksum from the 
plurality of checksums corresponding to that data block. 

The storage system of Claim 16, wherein: 

each data block in the plurality of data/mocks has a vertical redundant relationship with a 
set of corresponding checksums, and each of the checksums in the set of 
corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums in the set of corresponding checksums. 

The storage system of Claim 1 & wherein: 

said array manager is configured such that in response to detecting a first data integrity 
error between a first aata block and a first checksum from a first set of checksums 
corresponding to the first data block, said array manager reviews the vertical 
redundant relationship between the first data block and the remaining checksums 
in the first set of checksums; and 

said array manager is further configured such that in response to detecting no data 

integrity errors Between the first data block and the remaining checksums in the 
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20. 



The storage system of Claim 



said array manager is configure! sj^ch that in response to detection of a data integrity 

error in at least one of me plurality of data blocks, said array manager reviews the 
horizontal redundant relationship between the data block having the data integrity 
error and the remainmg data blocks in the plurality of data blocks. 




2 1 . The storage system of Claim 20, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and / 

said array manager is configured to review the horizontal redundant relationship by 

calculating a new parity sraipe unit based on the plurality of data stripe units and 
comparing the calculated/new parity stripe unit to the parity stripe unit from the 
plurality of data blocks./ 

22. The storage system of Clainy20, wherein; 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored data block; and 

said array manager is configured to review the horizontal redundant relationship by 
comparing the first mirrored data block and the second mirrored data block. 

23. The storage system ok Claim 20, wherein: 
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said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the vertical redundant relationships and detecting no data 
integrity errors in the horizontal redundant relationship, said array manager 
creates a restored checksum using the data block corresponding to the first data 
integrity error to replace the existing checksumycorresponding to the first data 
integrity error. / 

The storage system of Claim 20, wherein: / 

said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of the vertical redundant relationships and detecting a second 
data integrity error in the horizontawedundant relationship, said array manager 
creates a restored data block using/the horizontal redundant relationship to replace 
the data block corresponding to me first data integrity error and compares the 
restored data block to the checksum corresponding to the first data integrity error. 

The storage system of Claim 24, wMerein: 

said array manager is configured such that in response to a mismatch between the 

restored data block and tMe checksum corresponding to the first data integrity 
error, said array manager creates a restored checksum using the restored data 
block to replace the checksum corresponding to the first data integrity error. 

The storage system of Claim 20, further comprising: 

said array manager is configured such that in response to detecting a first data integrity 
error in a first venical redundant relationship, detecting a second data integrity 
error in a second/ vertical redundant relationship, and detecting no data integrity 
errors in the horizontal redundant relationship, said array manager reports a data 
loss condition/ 
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said array manager is configured such 
error in a first vertical redund* 



The storage system of Claim 20, wherein: 

that in response to detecting a first data integrity 
nt relationship, detecting a second data integrity 
error in a second vertical redundant relationship, and detecting a third data 
integrity error in the horizontal redundant relationship, said array manager: 

creates a first restored data block using the horizontal redundant relationship to 
replace the data bloc c corresponding to the first vertical redundant 
relationship; 

compares the first restored data block to the checksum corresponding to the first 
vertical redundant relationship; 

creates a second restored data block using the horizontal redundant relationship to 
replace the data block corresponding to the second vertical redundant 
relationship; and 

compares the second restor id data block to the checksum corresponding to the 
second vertical redvndant relationship. 



The storage system of Claim 27, w 



herem: 



said array manager is configured such that said array manager reports a data loss 
condition in response to eit ler: 

(a) a mismatch between thfe 



corresponding to the 
between the second 
to the second vertics 



first restored data block and the checksum 
first vertical redundant relationship and a mismatch 
restored data block and the checksum corresponding 
redundant relationship; or 

(b) a match between the firit restored data block and the checksum corresponding 
to the first vertical redundant relationship and a match between the second 
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restored data block and the checksum corresponding to the second vertical 
redundant relationship. 

The storage system of Claim 27, wherein: 

said array manager is configured such that ih response to a match between the first 

restored data block and the checksum corresponding to the first vertical redundant 
relationship and a mismatch between the second restored data block and the 
checksum corresponding to the second vertical redundant relationship, said array 
manager creates a restored checksum using the second restored data block to 
replace the checksum corresponding to the second vertical redundant relationship. 

The storage system of Claim 16, wherein: 

said array manager is configured ta report a data loss condition in response to detecting 
data integrity errors in at least three of the vertical redundant relationships. 

A computer-readable medium whose contents cause a computer system to operate a 
storage system by performing pe steps of: 

detecting a data integrity error in at least one of a plurality of data block having a 
horizontal redundant relationship; and 

analyzing a plurality of checksums, each checksum having a vertical redundant 
relationship with a corresponding one of the plurality of data blocks, said 
analyzing comprising reviewing the vertical redundant relationships between each 
of the checksums In the plurality of checksums and the corresponding data blocks. 

The computer-readable medium of Claim 3 1 , wherein: 
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said reviewing the vertical redundant relationships Comprises calculating a new checksum 
for each of the data blocks in the plurality/)f data blocks and comparing the 
calculated new checksum to the checksijm from the plurality of checksums 
corresponding to that data block. 

The computer-readable medium of Claimr31, wherein: 

each data block in the plurality of data/blocks has a vertical redundant relationship with a 
set of corresponding checksums, and each of the checksums in the set of 
corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums in the set of corresponding checksums. 

The computer-readable medium of Claim 33, wherein the contents of the computer- 
readable medium cause thf computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error between a first data block and a first 
checksum from a first set of checksums corresponding to the first data block, 
reviewing the vertical redundant relationship between the first data block and the 
remaining /checksums in the first set of checksums; and { 

in response to detecting no data integrity errors between the first data block and the 
remaining checksums in the first set of checksums, creating a restored first 
checksum to replace the first checksum corresponding to the first data integrity 
errc 



The computer-readable 
readable medium cause thl 
the further steps of: 




im 3 1, wherein the contents of the computer- 
iputer system to operate the storage system by performing 
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in response to detection 
blocks, reviewin; 
having the data iijte 
data blocks, 



data integrity error in at least one of the plurality of data 
fe horizontal redttflcfant relationship between the data block 
sfror and the remaining data blocks in the plurality of 



The computer-readable medium of Claim 35, wherein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said reviewing the horizontal redundant relationship comprises calculating a new parity 
stripe unit based on the plurality oydata stripe units and comparing the calculated 
new parity stripe unit to the parity stripe unit from the plurality of data blocks. 



The computer-readable medium of Claim 35, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored data block;/and 

said reviewing the horizontal redundant relationship comprises comparing the first 
mirrored data block and the second mirrored data block. 



The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in exactly one of the vertical redundant 
relationships and detecting no data integrity errors in the horizontal redundant 
relationship, creating a restored checksum using the data block corresponding to 
the first data integrity error to replace the existing checksum corresponding to the 
first data integrity error. 
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The computer-readable medium of Claim 35, wherein |he contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: / 

in response to detecting a first data integrity error iiyexactly one of the vertical redundant 
relationships and detecting a second data in/egrity error in the horizontal 
redundant relationship, creating a restored/data block using the horizontal 
redundant relationship to replace the dat^block corresponding to the first data 
integrity error and comparing the restored data block to the checksum 
corresponding to the first data integrity/error. 

The computer-readable medium of Claim 30, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the farther steps of: / 

in response to a mismatch between the restored data block and the checksum 

corresponding to the first data integrity error, creating a restored checksum using 
the restored data block to replace the checksum corresponding to the first data 
integrity error. / 

The computer-readable medium of Claim 35, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: / 

in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity error in a second vertical redundant 
relationship, and defecting no data integrity errors in the horizontal redundant 
relationship, reporting a data loss condition. 
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The computer-readable medium of Claim 35 5 wherein the /contents of the computer- 
readable medium cause the computer system to operate tpe storage system by performing 
the further steps of: 

in response to detecting a first data integrity error in a first vertical redundant 

relationship, detecting a second data integrity yerror in a second vertical redundant 
relationship, and detecting a third data integrity error in the horizontal redundant 
relationship: 

creating a first restored data block using tfte horizontal redundant relationship to 
replace the data block corresponding to the first vertical redundant 
relationship; 

comparing the first restored data block to the checksum corresponding to the first 
vertical redundant relationship; 

creating a second restored data block using the horizontal redundant relationship 
to replace the data block corresponding to the second vertical redundant 
relationship; and 

comparing the second restore^ data block to the checksum corresponding to the 
second vertical redundant relationship. 

The computer-readable medium of Claim 42, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: 

reporting a data loss conditio^m response to either: 

(a) a mismatch between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch 
between theiecond restored data block and the checksum corresponding 
to the second vertical redundant relationship; or 
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(b) a match between the first restored data blocfl and the checksum corresponding 
to the first vertical redundant relationship and a match between the second 
restored data block and the checksum .corresponding to the second vertical 
redundant relationship. / 

The computer-readable medium of Claim 42, wnerein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: / 

in response to a match between the first restored data block and the checksum 

corresponding to the first vertical redundant relationship and a mismatch between 
the second restored data block and the checksum corresponding to the second 
vertical redundant relationship/creating a restored checksum using the second 
restored data block to replaceythe checksum corresponding to the second vertical 
redundant relationship. / 

The computer-readable mediumyof Claim 31, wherein the contents of the computer- 
readable medium cause the computer system to operate the storage system by performing 
the further steps of: / 

in response to detecting dat^integrity errors in at least three of the vertical redundant 
relationships, reporting a data loss. 

A storage system, composing: 

a plurality of storage devices configured to store a plurality of data blocks and a plurality 
of checksums, wherein each data block in said plurality of data blocks has a first 
type of redundant relationship with a corresponding one of the plurality of 
checksums and each data block in said plurality of data blocks has a second type 
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of redundant relationship with the remaining d&ta blocks in said plurality of data 
blocks; and / 

an array manager coupled to said plurality of storage devices, wherein said array manager 
is configured to detect a data integrity erro/ in one of the first type of redundant 
relationships between the plurality of data blocks and the plurality of checksums 
and to check for additional data integrity errors in the remaining first type of 
redundant relationships between the plurality of data blocks and the plurality of 
checksums. / 

The storage system of Claim 46, wherein:/ 

said array manager is configured to check for additional data integrity errors in the 
remaining first type of redundant relationships between the plurality of data 
blocks and the plurality of checksums by calculating a new checksum for each of 
the data blocks in the plurality of data blocks and comparing the calculated new 
checksum to the checksum from the plurality of checksums corresponding to that 
data block. / 

The storage system of Claim 46/ wherein: 

each data block in the pluralitj/of data blocks has a vertical redundant relationship with a 
set of corresponding checksums, and each of the checksums in the set of 
corresponding checksums has a horizontal checksum redundant relationship with 
the other checksums/in the set of corresponding checksums. 

The storage system of Claim 48, wherein: 

said array manager is configured such that in response to detecting a first data integrity 

error between a first data block and a first checksum from a first set of checksums 
corresponding to the first data block, said array manager reviews the redundant 
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relationships between the first data blqpi^and the remaining checksums in the first 
set of checksums; and 

said array manager is further configured such that in response to detecting no data 

integrity errors between t#e first data block and the remaining checksums in the 
first set of checksums^/said array manager creates a restored first checksum to 
replace the first checksum corresponding to the first data integrity error. 



The storage system of Claim 

said array manager is configiji: 
error in at least one of 



6, wherei 

suon that in response to detection of a data integrity 



theyplurality of data blocks, said array manager reviews the 
second type of redundant relationship between the data block having the data 
integrity error and th/remaining data blocks in the plurality of data blocks. 



The storage system of Claim 50, wh^ein: 

said plurality of data blocks comprises a plurality of data stripe units and a parity stripe 
unit; and 

said array manager is configured to review the second type of redundant relationship by 
calculating a new parity stripe unit based on the plurality of data stripe units and 
comparing the calculated new parity stripe unit to the parity stripe unit from the 
plurality of data blocks. 



The storage system of Claim 50, wherein: 

said plurality of data blocks comprises a first mirrored data block and a corresponding 
second mirrored/data block; and 

said array manager is configured to review the second type of redundant relationship by 
comparing the : irst mirrored data block and the second mirrored data block. 
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The storage system of Claim 50^ 
said array manager is configured 



wherein: 



The storage system of Claim 50 



i such that in response to detecting a first data integrity 
error in exactly one of the first type of redundant relationships and detecting no 
data integrity errors in the second type of redundant relationship, said array 
manager creates a restored checksum using the data block corresponding to the 
first data integrity error tc replace the existing checksum corresponding to the first 
data integrity error. 



wherein: 



said array manager is configured such that in response to detecting a first data integrity 
error in exactly one of tl e first type of redundant relationships and detecting a 
second data integrity en or in the second type of redundant relationship, said array 
manager creates a restored data block using the second type of redundant 
relationship to replace trie data block corresponding to the first data integrity error 
and compares the restoi ed data block to the checksum corresponding to the first 
data integrity error. 



The storage system of Claim 54, wherein: 

said array manager is configured such that in response to a mismatch between the 

restored data block an< the checksum corresponding to the first data integrity 
error, said array manager creates a restored checksum using the restored data 
block to replace the checksum corresponding to the first data integrity error. 



The storage system of Claim 50, further comprising: 
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said array manager is configured such that in respdnse to detecting a first data integrity 
error in a first one of the first type of redundant relationship, detecting a second 
data integrity error in a second one of the tfirst type of redundant relationship, and 
detecting no data integrity errors in the second type of redundant relationship, said 
array manager reports a data loss condition. 

The storage system of Claim 50, wherein: / 

said array manager is configured such that/in response to detecting a first data integrity 
error in a first one of the first type/of redundant relationship, detecting a second 
data integrity error in a second one of the first type of redundant relationship, and 
detecting a third data integrity ei/ror in the second type of redundant relationship, 
said array manager: / 

creates a first restored data block using the second type of redundant relationship 
to replace the data block corresponding to the first one of the first type of 
redundant relationship; 

compares the first restored/data block to the checksum corresponding to the first 
one of the first type of redundant relationship; 

creates a second restored/data block using the second type of redundant 

relationship to replace the data block corresponding to the second one of 
the first type of redundant relationship; and 

compares the second restored data block to the checksum corresponding to the 
second one of the first type of redundant relationship. 

The storage system of Claim 57, wherein: 

said array manager is configured such that said array manager reports a data loss 
condition in response to either: 
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(a) a mismatch between the first restored data block and the checksum 

corresponding to the first one of the firsft type of redundant relationship 
and a mismatch between the second restored data block and the checksum 
corresponding to the second one ofyflie first type of redundant relationship; 
or 

(b) a match between the first restored tffat a block and the checksum corresponding 

to the first one of the first type of redundant relationship and a match 
between the second restoredr data block and the checksum corresponding 
to the second one of the fi/st type of redundant relationship. 



The storage system of Claim 57, wh^ein: 

said array manager is configured such that in response to a match between the first 

restored data block and the checksum corresponding to the first one of the first 
type of redundant relationship and a mismatch between the second restored data 
block and the checksum corresponding to the second one of the first type of 
redundant relationship, said array manager creates a restored checksum using the 
second restored dat^>lock to replace the checksum corresponding to the second 
one of the first typer of redundant relationship. 



The storage system of Claim 46, wherein: 

said array manager is configured to report a data loss condition in response to detecting 
data integrity/errors in at least three of the first type of redundant relationships. 
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